From 864fa34bedd56877f34ff181fc8e7eaa1e6a6919 Mon Sep 17 00:00:00 2001
From: sneak <sneak@sneak.berlin>
Date: Fri, 2 Oct 2026 02:31:53 +0000
Subject: [PATCH] ci: a push cancels its branch's older run, checkout keeps no
 token (closes #216)

Every push queues a run on the shared runner, and a branch pushed again
left its older run queued for a head nobody needed. The workflow now puts
each branch's runs in one concurrency group with cancel-in-progress, so a
new push cancels that branch's older run, queued or running. The group is
keyed on the branch, so pushes to other branches never cancel runs on
`next` or `main`; a push to `next` itself does cancel the older `next` run.

The checkout step no longer writes the token into `.git/config`;
`script/cibuild` does not need it.

Model: opus-5-5
---
 .gitea/workflows/check.yml | 8 ++++++++
 TODO.md                    | 2 ++
 2 files changed, 10 insertions(+)

diff --git a/.gitea/workflows/check.yml b/.gitea/workflows/check.yml
index a55bc55..81b7e10 100644
--- a/.gitea/workflows/check.yml
+++ b/.gitea/workflows/check.yml
@@ -1,9 +1,17 @@
 name: check
 on: [push]
+# A new push to a branch cancels that branch's older run, queued or running;
+# runs on other branches, `next` and `main` among them, are left alone.
+concurrency:
+    group: ${{ github.workflow }}-${{ github.ref }}
+    cancel-in-progress: true
 jobs:
     check:
         runs-on: ubuntu-latest
         steps:
             # actions/checkout v4.2.2, 2026-02-28
             - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+              # script/cibuild needs no token, so none is left in .git/config.
+              with:
+                  persist-credentials: false
             - run: script/cibuild
diff --git a/TODO.md b/TODO.md
index 27c8b3f..96b90c5 100644
--- a/TODO.md
+++ b/TODO.md
@@ -19,6 +19,8 @@ trial run of the finished image: https://git.eeqj.de/sneak/dnswatcher/issues/149
 
 # Completed Steps
 
+- 2026-10-02: a push to a branch cancels that branch's older CI run, and the
+  checkout leaves no token in `.git/config` (closes #216).
 - 2026-10-02: watcher tests send far fewer queries and a live attempt may take
   18s; nameserver addresses are asked only for A, AAAA, CNAME (closes #214).
 - 2026-10-02: the resolver tries root servers, and every other server list it
-- 
2.54.0